Is your car going to snitch on you? It’s a question on the minds of many enthusiasts given this year’s version of the annual transportation bill meandering through Congress: It contains a section mandating event data recorders, a.k.a. black boxes, for all cars sold in the U.S. as of model year 2015. The bill also purports to resolve a debate over who owns information gathered by the devices—which, it should be noted, already have been installed in most cars for years—by giving the owner clear control over the numbers inside, but the data still could be accessed by government agencies via court order or in other circumstances.

Quick legislative-branch review: Each house of Congress, the House of Representatives and the Senate, pass different versions of bills. These then have to be reconciled before they become a law. (Thanks, “Schoolhouse Rock”!) In this case, the details in the bill (Senate Bill 1813) could change when this becomes law, as the House is considering a version with slightly different language. (The House is widely expected to pass the measure, however, once the minor discrepancies are resolved.) Either way, it’s still pretty vague. The Senate bill insists only that devices must “capture and store data related to motor vehicle safety” and release this information to an “interoperable data access port.”

Which data is related to safety? The bill doesn’t define that but insists that this data, whatever it is, must be captured for a “reasonable time period before, during, and after” any crash or event that triggers the airbags. The Department of Transportation has already developed a standard set of data that includes 15 different measurements such as direction of acceleration, throttle position, and the moment the airbags fired. (Many manufacturers’ boxes capture additional information.) This structure is likely to be the foundation of the mandated information to be recorded, starting with the 2015 model year.

What the Senate bill does make clear is that the data is owned by the car’s owner or lessee. But if the police or other agencies want to retrieve it without the owner’s consent, they’ll need a court order. First responders such as paramedics would also have access to the data—without a court order, even—in cases where it will help them respond to an emergency.

The sensitivity, of course, comes from the potential incrimination of drivers by using the data. Stuff like intake-manifold pressure and fuel mixture are of interest only to the hardest-core gearheads, but information on raw speed and pedal application could be used against a driver. While finding fault in a fatal accident—or, say, clearing an automaker of unintended-acceleration accusations—are noble causes, what’s stopping agencies from seeking court-mandated access to the box for simple speeding violations? A lot, as it turns out. The requirements for getting a court order for access are likely to be as stringent as they are for issuing a search warrant. Without a warrant, many states’ laws might make it illegal to use black-box data for issuing traffic tickets. In New York, for example, police are not allowed to issue tickets using EZ Pass toll data to calculate a driver’s average speed.

Demands for the data from investigators are not uncommon today, as lawyers begin to look to the devices to help blame someone after a crash. For instance, the Los Angeles Times reported in 2010 that the National Highway Traffic Safety Administration (NHTSA) subpoenaed a black box taken from the wreck of a Toyota Tundra that killed its driver. There was alcohol reported to be found in the blood of the driver, but the family thought that perhaps Toyota might be at fault because of errant data found recorded by the box. There also is a growing network of professional private investigators that specializes in forensic reconstruction of accidents, and they frequently tap in to the contents of the event data recorder.

Some are pushing Congress to do more than add legal restrictions to data access. “It’s almost a done deal that they’re going to mandate,” said Tom Kowalick, an engineer who helped draft the IEEE standard for event data recorders. “The question is: What’s in it for the consumer?” Kowalick would like Congress to let owners lock up the data with a key that gives the owner physical control of access, and he’s circulating a petition to ask the Obama administration to add tighter electronic controls on the data. The physical key would stop the highly unlikely cases of idle snooping—the Jiffy Lube guy doesn’t care about your driving habits—but it’s an incredibly symbolic gesture: Again, the courts would still be able to demand the data with a subpoena.